Which versions of Openclaw are affected by CVE-2026-32027?

CVE-2026-32027 presents moderate security risk, a path traversal vulnerability rated CVSS 7.1.. A patch is available.

How to fix or mitigate CVE-2026-32027?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Review file handling controls and restrict upload directories.

Openclaw CVE-2026-32027

Q: What is the CVSS score of CVE-2026-32027?

CVE-2026-32027 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Path Traversal (CWE-22)

2026-03-19 disclosure@vulncheck.com

GHSA-jv6r-27ww-4gw4

Path Traversal Openclaw

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.2.26.

DescriptionCVE.org

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context authorization flaw by using a sender approved via DM pairing to satisfy group sender allowlist checks without explicit presence in groupAllowFrom, bypassing group message access controls.

AnalysisAI

OpenClaw versions prior to 2026.2.26 contain a critical authorization bypass vulnerability where Direct Message (DM) pairing-store identities are incorrectly reused to satisfy group-level sender allowlist authorization checks. An attacker with valid DM pairing credentials can send messages to groups without being explicitly listed in the group's allowFrom access control list, effectively bypassing group message access controls. This vulnerability requires authenticated access (PR:L) but enables high-confidence information disclosure (C:H), with a CVSS score of 6.5 reflecting the combination of network accessibility and authentication requirement.

Technical ContextAI

The vulnerability stems from improper authorization logic in OpenClaw's messaging architecture, specifically a cross-context identity inheritance flaw classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The root cause is that the authorization system fails to properly isolate context boundaries between DM pairing-store identities and group-level access controls. When OpenClaw evaluates whether a sender is permitted to post to a group, it incorrectly accepts identities that have been pre-approved in the DM pairing store (a separate authorization context) without re-validating that same identity against the group's explicit groupAllowFrom allowlist. This represents a failure to properly enforce authorization domain separation, allowing a sender's legitimacy in one context (DM communications) to be incorrectly leveraged in another context (group messaging). The vulnerability affects OpenClaw product versions prior to 2026.2.26, as documented in the vendor's GitHub security advisory GHSA-jv6r-27ww-4gw4.

RemediationAI

Upgrade OpenClaw to version 2026.2.26 or later immediately, following the vendor's official patch release guidance available at https://github.com/openclaw/openclaw/security/advisories/GHSA-jv6r-27ww-4gw4. The vendor has provided specific commits addressing the authorization context isolation flaw; apply these patches or use the corresponding release build. If immediate patching is not feasible, implement compensating controls by restricting network access to OpenClaw group messaging endpoints to only trusted internal networks, enforcing mutual TLS authentication for all group message submissions, and implementing additional audit logging on all group message access attempts to detect suspicious cross-context authorization patterns. Additionally, review group allowlist configurations to ensure they are explicitly populated and verify that no users have unexpectedly gained group access via DM pairing credentials. Organizations should prioritize this patching as a high-priority security update given the direct impact on message access control confidentiality.